1 <?xml version='1.0'?> <!--*-nxml-*-->
2 <?xml-stylesheet type="text/xsl" href="http://docbook.sourceforge.net/release/xsl/current/xhtml/docbook.xsl"?>
3 <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
4 "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
7 This file is part of systemd.
9 Copyright 2010 Lennart Poettering
11 systemd is free software; you can redistribute it and/or modify it
12 under the terms of the GNU Lesser General Public License as published by
13 the Free Software Foundation; either version 2.1 of the License, or
14 (at your option) any later version.
16 systemd is distributed in the hope that it will be useful, but
17 WITHOUT ANY WARRANTY; without even the implied warranty of
18 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
19 Lesser General Public License for more details.
21 You should have received a copy of the GNU Lesser General Public License
22 along with systemd; If not, see <http://www.gnu.org/licenses/>.
25 <refentry id="systemd.exec">
27 <title>systemd.exec</title>
28 <productname>systemd</productname>
32 <contrib>Developer</contrib>
33 <firstname>Lennart</firstname>
34 <surname>Poettering</surname>
35 <email>lennart@poettering.net</email>
41 <refentrytitle>systemd.exec</refentrytitle>
42 <manvolnum>5</manvolnum>
46 <refname>systemd.exec</refname>
47 <refpurpose>Execution environment configuration</refpurpose>
51 <para><filename><replaceable>service</replaceable>.service</filename>,
52 <filename><replaceable>socket</replaceable>.socket</filename>,
53 <filename><replaceable>mount</replaceable>.mount</filename>,
54 <filename><replaceable>swap</replaceable>.swap</filename></para>
58 <title>Description</title>
60 <para>Unit configuration files for services, sockets,
61 mount points and swap devices share a subset of
62 configuration options which define the execution
63 environment of spawned processes.</para>
65 <para>This man page lists the configuration options
66 shared by these four unit types. See
67 <citerefentry><refentrytitle>systemd.unit</refentrytitle><manvolnum>5</manvolnum></citerefentry>
68 for the common options of all unit configuration
70 <citerefentry><refentrytitle>systemd.service</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
71 <citerefentry><refentrytitle>systemd.socket</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
72 <citerefentry><refentrytitle>systemd.swap</refentrytitle><manvolnum>5</manvolnum></citerefentry>
74 <citerefentry><refentrytitle>systemd.mount</refentrytitle><manvolnum>5</manvolnum></citerefentry>
75 for more information on the specific unit
76 configuration files. The execution specific
77 configuration options are configured in the [Service],
78 [Socket], [Mount], or [Swap] sections, depending on the unit
83 <title>Options</title>
85 <variablelist class='unit-directives'>
88 <term><varname>WorkingDirectory=</varname></term>
90 <listitem><para>Takes an absolute
91 directory path. Sets the working
92 directory for executed processes. If
93 not set defaults to the root directory
94 when systemd is running as a system
95 instance and the respective user's
96 home directory if run as
97 user.</para></listitem>
101 <term><varname>RootDirectory=</varname></term>
103 <listitem><para>Takes an absolute
104 directory path. Sets the root
105 directory for executed processes, with
107 <citerefentry><refentrytitle>chroot</refentrytitle><manvolnum>2</manvolnum></citerefentry>
108 system call. If this is used it must
109 be ensured that the process and all
110 its auxiliary files are available in
111 the <function>chroot()</function>
112 jail.</para></listitem>
116 <term><varname>User=</varname></term>
117 <term><varname>Group=</varname></term>
119 <listitem><para>Sets the Unix user
120 or group that the processes are executed
121 as, respectively. Takes a single user or group
122 name or ID as argument. If no group is
123 set, the default group of the user is
124 chosen.</para></listitem>
128 <term><varname>SupplementaryGroups=</varname></term>
130 <listitem><para>Sets the supplementary
131 Unix groups the processes are executed
132 as. This takes a space-separated list
133 of group names or IDs. This option may
134 be specified more than once in which
135 case all listed groups are set as
136 supplementary groups. When the empty
137 string is assigned the list of
138 supplementary groups is reset, and all
139 assignments prior to this one will
140 have no effect. In any way, this
141 option does not override, but extends
142 the list of supplementary groups
143 configured in the system group
145 user.</para></listitem>
149 <term><varname>Nice=</varname></term>
151 <listitem><para>Sets the default nice
152 level (scheduling priority) for
153 executed processes. Takes an integer
154 between -20 (highest priority) and 19
155 (lowest priority). See
156 <citerefentry><refentrytitle>setpriority</refentrytitle><manvolnum>2</manvolnum></citerefentry>
157 for details.</para></listitem>
161 <term><varname>OOMScoreAdjust=</varname></term>
163 <listitem><para>Sets the adjustment
164 level for the Out-Of-Memory killer for
165 executed processes. Takes an integer
166 between -1000 (to disable OOM killing
167 for this process) and 1000 (to make
168 killing of this process under memory
169 pressure very likely). See <ulink
170 url="http://www.kernel.org/doc/Documentation/filesystems/proc.txt">proc.txt</ulink>
171 for details.</para></listitem>
175 <term><varname>IOSchedulingClass=</varname></term>
177 <listitem><para>Sets the IO scheduling
178 class for executed processes. Takes an
179 integer between 0 and 3 or one of the
180 strings <option>none</option>,
181 <option>realtime</option>,
182 <option>best-effort</option> or
183 <option>idle</option>. See
184 <citerefentry><refentrytitle>ioprio_set</refentrytitle><manvolnum>2</manvolnum></citerefentry>
185 for details.</para></listitem>
189 <term><varname>IOSchedulingPriority=</varname></term>
191 <listitem><para>Sets the IO scheduling
192 priority for executed processes. Takes
193 an integer between 0 (highest
194 priority) and 7 (lowest priority). The
195 available priorities depend on the
196 selected IO scheduling class (see
198 <citerefentry><refentrytitle>ioprio_set</refentrytitle><manvolnum>2</manvolnum></citerefentry>
199 for details.</para></listitem>
203 <term><varname>CPUSchedulingPolicy=</varname></term>
205 <listitem><para>Sets the CPU
206 scheduling policy for executed
207 processes. Takes one of
208 <option>other</option>,
209 <option>batch</option>,
210 <option>idle</option>,
211 <option>fifo</option> or
212 <option>rr</option>. See
213 <citerefentry><refentrytitle>sched_setscheduler</refentrytitle><manvolnum>2</manvolnum></citerefentry>
214 for details.</para></listitem>
218 <term><varname>CPUSchedulingPriority=</varname></term>
220 <listitem><para>Sets the CPU
221 scheduling priority for executed
222 processes. The available priority
223 range depends on the selected CPU
224 scheduling policy (see above). For
225 real-time scheduling policies an
226 integer between 1 (lowest priority)
227 and 99 (highest priority) can be used.
228 See <citerefentry><refentrytitle>sched_setscheduler</refentrytitle><manvolnum>2</manvolnum></citerefentry>
234 <term><varname>CPUSchedulingResetOnFork=</varname></term>
236 <listitem><para>Takes a boolean
237 argument. If true elevated CPU
238 scheduling priorities and policies
239 will be reset when the executed
240 processes fork, and can hence not leak
241 into child processes. See
242 <citerefentry><refentrytitle>sched_setscheduler</refentrytitle><manvolnum>2</manvolnum></citerefentry>
243 for details. Defaults to false.</para></listitem>
247 <term><varname>CPUAffinity=</varname></term>
249 <listitem><para>Controls the CPU
250 affinity of the executed
251 processes. Takes a space-separated
252 list of CPU indexes. This option may
253 be specified more than once in which
254 case the specificed CPU affinity masks
255 are merged. If the empty string is
256 assigned the mask is reset, all
257 assignments prior to this will have no
259 <citerefentry><refentrytitle>sched_setaffinity</refentrytitle><manvolnum>2</manvolnum></citerefentry>
260 for details.</para></listitem>
264 <term><varname>UMask=</varname></term>
266 <listitem><para>Controls the file mode
267 creation mask. Takes an access mode in
269 <citerefentry><refentrytitle>umask</refentrytitle><manvolnum>2</manvolnum></citerefentry>
270 for details. Defaults to
271 0022.</para></listitem>
275 <term><varname>Environment=</varname></term>
277 <listitem><para>Sets environment
278 variables for executed
279 processes. Takes a space-separated
280 list of variable assignments. This
281 option may be specified more than once
282 in which case all listed variables
283 will be set. If the same variable is
284 set twice the later setting will
285 override the earlier setting. If the
286 empty string is assigned to this
287 option the list of environment
288 variables is reset, all prior
289 assignments have no effect.
290 Variable expansion is not performed
291 inside the strings, however, specifier
292 expansion is possible. $ character has
294 If you need to assign a value containing spaces
295 to a variable, use double quotes (")
296 for the assignment.</para>
299 <programlisting>Environment="VAR1=word1 word2" VAR2=word3 "VAR3=word 5 6"</programlisting>
300 gives three variables <literal>VAR1</literal>,
301 <literal>VAR2</literal>, <literal>VAR3</literal>.
306 <citerefentry><refentrytitle>environ</refentrytitle><manvolnum>7</manvolnum></citerefentry>
307 for details about environment variables.</para></listitem>
310 <term><varname>EnvironmentFile=</varname></term>
311 <listitem><para>Similar to
312 <varname>Environment=</varname> but
313 reads the environment variables from a
314 text file. The text file should
315 contain new-line-separated variable
316 assignments. Empty lines and lines
317 starting with ; or # will be ignored,
318 which may be used for commenting. A line
319 ending with a backslash will be concatenated
320 with the following one, allowing multiline variable
321 definitions. The parser strips leading
322 and trailing whitespace from the values
323 of assignments, unless you use
324 double quotes (").</para>
326 <para>The argument passed should be an
327 absolute filename or wildcard
328 expression, optionally prefixed with
329 <literal>-</literal>, which indicates
330 that if the file does not exist it
331 won't be read and no error or warning
332 message is logged. This option may be
333 specified more than once in which case
334 all specified files are read. If the
335 empty string is assigned to this
336 option the list of file to read is
337 reset, all prior assignments have no
340 <para>The files listed with this
341 directive will be read shortly before
342 the process is executed. Settings from
343 these files override settings made
345 <varname>Environment=</varname>. If
346 the same variable is set twice from
347 these files the files will be read in
348 the order they are specified and the
349 later setting will override the
350 earlier setting.</para></listitem>
354 <term><varname>StandardInput=</varname></term>
355 <listitem><para>Controls where file
356 descriptor 0 (STDIN) of the executed
357 processes is connected to. Takes one
358 of <option>null</option>,
359 <option>tty</option>,
360 <option>tty-force</option>,
361 <option>tty-fail</option> or
362 <option>socket</option>. If
363 <option>null</option> is selected
364 standard input will be connected to
365 <filename>/dev/null</filename>,
366 i.e. all read attempts by the process
367 will result in immediate EOF. If
368 <option>tty</option> is selected
369 standard input is connected to a TTY
371 <varname>TTYPath=</varname>, see
372 below) and the executed process
373 becomes the controlling process of the
374 terminal. If the terminal is already
375 being controlled by another process the
376 executed process waits until the current
377 controlling process releases the
379 <option>tty-force</option>
380 is similar to <option>tty</option>,
381 but the executed process is forcefully
382 and immediately made the controlling
383 process of the terminal, potentially
384 removing previous controlling
386 terminal. <option>tty-fail</option> is
387 similar to <option>tty</option> but if
388 the terminal already has a controlling
389 process start-up of the executed
391 <option>socket</option> option is only
392 valid in socket-activated services,
393 and only when the socket configuration
395 <citerefentry><refentrytitle>systemd.socket</refentrytitle><manvolnum>5</manvolnum></citerefentry>
396 for details) specifies a single socket
397 only. If this option is set standard
398 input will be connected to the socket
399 the service was activated from, which
400 is primarily useful for compatibility
401 with daemons designed for use with the
403 <citerefentry><refentrytitle>inetd</refentrytitle><manvolnum>8</manvolnum></citerefentry>
404 daemon. This setting defaults to
405 <option>null</option>.</para></listitem>
408 <term><varname>StandardOutput=</varname></term>
409 <listitem><para>Controls where file
410 descriptor 1 (STDOUT) of the executed
411 processes is connected to. Takes one
412 of <option>inherit</option>,
413 <option>null</option>,
414 <option>tty</option>,
415 <option>syslog</option>,
416 <option>kmsg</option>,
417 <option>journal</option>,
418 <option>syslog+console</option>,
419 <option>kmsg+console</option>,
420 <option>journal+console</option> or
421 <option>socket</option>. If set to
422 <option>inherit</option> the file
423 descriptor of standard input is
424 duplicated for standard output. If set
425 to <option>null</option> standard
426 output will be connected to
427 <filename>/dev/null</filename>,
428 i.e. everything written to it will be
429 lost. If set to <option>tty</option>
430 standard output will be connected to a
431 tty (as configured via
432 <varname>TTYPath=</varname>, see
433 below). If the TTY is used for output
434 only the executed process will not
435 become the controlling process of the
436 terminal, and will not fail or wait
437 for other processes to release the
438 terminal. <option>syslog</option>
439 connects standard output to the
440 <citerefentry><refentrytitle>syslog</refentrytitle><manvolnum>3</manvolnum></citerefentry>
442 service. <option>kmsg</option>
443 connects it with the kernel log buffer
444 which is accessible via
445 <citerefentry><refentrytitle>dmesg</refentrytitle><manvolnum>1</manvolnum></citerefentry>. <option>journal</option>
446 connects it with the journal which is
448 <citerefentry><refentrytitle>journalctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>
449 (Note that everything that is written
450 to syslog or kmsg is implicitly stored
451 in the journal as well, those options
452 are hence supersets of this
453 one). <option>syslog+console</option>,
454 <option>journal+console</option> and
455 <option>kmsg+console</option> work
456 similarly but copy the output to the
458 well. <option>socket</option> connects
459 standard output to a socket from
460 socket activation, semantics are
461 similar to the respective option of
462 <varname>StandardInput=</varname>.
463 This setting defaults to the value set
465 <option>DefaultStandardOutput=</option>
467 <citerefentry><refentrytitle>systemd-system.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
469 <option>journal</option>.</para></listitem>
472 <term><varname>StandardError=</varname></term>
473 <listitem><para>Controls where file
474 descriptor 2 (STDERR) of the executed
475 processes is connected to. The
476 available options are identical to
478 <varname>StandardOutput=</varname>,
479 with one exception: if set to
480 <option>inherit</option> the file
481 descriptor used for standard output is
482 duplicated for standard error. This
483 setting defaults to the value set with
484 <option>DefaultStandardError=</option>
486 <citerefentry><refentrytitle>systemd-system.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
488 <option>inherit</option>.</para></listitem>
491 <term><varname>TTYPath=</varname></term>
492 <listitem><para>Sets the terminal
493 device node to use if standard input,
494 output or stderr are connected to a
495 TTY (see above). Defaults to
496 <filename>/dev/console</filename>.</para></listitem>
499 <term><varname>TTYReset=</varname></term>
500 <listitem><para>Reset the terminal
501 device specified with
502 <varname>TTYPath=</varname> before and
503 after execution. Defaults to
504 <literal>no</literal>.</para></listitem>
507 <term><varname>TTYVHangup=</varname></term>
508 <listitem><para>Disconnect all clients
509 which have opened the terminal device
511 <varname>TTYPath=</varname>
512 before and after execution. Defaults
514 <literal>no</literal>.</para></listitem>
517 <term><varname>TTYVTDisallocate=</varname></term>
518 <listitem><para>If the terminal
519 device specified with
520 <varname>TTYPath=</varname> is a
521 virtual console terminal try to
522 deallocate the TTY before and after
523 execution. This ensures that the
524 screen and scrollback buffer is
526 <literal>no</literal>.</para></listitem>
529 <term><varname>SyslogIdentifier=</varname></term>
530 <listitem><para>Sets the process name
531 to prefix log lines sent to syslog or
532 the kernel log buffer with. If not set
533 defaults to the process name of the
534 executed process. This option is only
536 <varname>StandardOutput=</varname> or
537 <varname>StandardError=</varname> are
538 set to <option>syslog</option> or
539 <option>kmsg</option>.</para></listitem>
542 <term><varname>SyslogFacility=</varname></term>
543 <listitem><para>Sets the syslog
544 facility to use when logging to
545 syslog. One of <option>kern</option>,
546 <option>user</option>,
547 <option>mail</option>,
548 <option>daemon</option>,
549 <option>auth</option>,
550 <option>syslog</option>,
551 <option>lpr</option>,
552 <option>news</option>,
553 <option>uucp</option>,
554 <option>cron</option>,
555 <option>authpriv</option>,
556 <option>ftp</option>,
557 <option>local0</option>,
558 <option>local1</option>,
559 <option>local2</option>,
560 <option>local3</option>,
561 <option>local4</option>,
562 <option>local5</option>,
563 <option>local6</option> or
564 <option>local7</option>. See
565 <citerefentry><refentrytitle>syslog</refentrytitle><manvolnum>3</manvolnum></citerefentry>
566 for details. This option is only
568 <varname>StandardOutput=</varname> or
569 <varname>StandardError=</varname> are
570 set to <option>syslog</option>.
572 <option>daemon</option>.</para></listitem>
575 <term><varname>SyslogLevel=</varname></term>
576 <listitem><para>Default syslog level
577 to use when logging to syslog or the
578 kernel log buffer. One of
579 <option>emerg</option>,
580 <option>alert</option>,
581 <option>crit</option>,
582 <option>err</option>,
583 <option>warning</option>,
584 <option>notice</option>,
585 <option>info</option>,
586 <option>debug</option>. See
587 <citerefentry><refentrytitle>syslog</refentrytitle><manvolnum>3</manvolnum></citerefentry>
588 for details. This option is only
590 <varname>StandardOutput=</varname> or
591 <varname>StandardError=</varname> are
592 set to <option>syslog</option> or
593 <option>kmsg</option>. Note that
594 individual lines output by the daemon
595 might be prefixed with a different log
596 level which can be used to override
597 the default log level specified
598 here. The interpretation of these
599 prefixes may be disabled with
600 <varname>SyslogLevelPrefix=</varname>,
601 see below. For details see
602 <citerefentry><refentrytitle>sd-daemon</refentrytitle><manvolnum>3</manvolnum></citerefentry>.
605 <option>info</option>.</para></listitem>
609 <term><varname>SyslogLevelPrefix=</varname></term>
610 <listitem><para>Takes a boolean
611 argument. If true and
612 <varname>StandardOutput=</varname> or
613 <varname>StandardError=</varname> are
614 set to <option>syslog</option>,
615 <option>kmsg</option> or
616 <option>journal</option>, log lines
617 written by the executed process that
618 are prefixed with a log level will be
619 passed on to syslog with this log
620 level set but the prefix removed. If
621 set to false, the interpretation of
622 these prefixes is disabled and the
623 logged lines are passed on as-is. For
624 details about this prefixing see
625 <citerefentry><refentrytitle>sd-daemon</refentrytitle><manvolnum>3</manvolnum></citerefentry>.
626 Defaults to true.</para></listitem>
630 <term><varname>TimerSlackNSec=</varname></term>
631 <listitem><para>Sets the timer slack
632 in nanoseconds for the executed
633 processes. The timer slack controls
634 the accuracy of wake-ups triggered by
636 <citerefentry><refentrytitle>prctl</refentrytitle><manvolnum>2</manvolnum></citerefentry>
637 for more information. Note that in
638 contrast to most other time span
639 definitions this parameter takes an
640 integer value in nano-seconds if no
641 unit is specified. The usual time
643 too.</para></listitem>
647 <term><varname>LimitCPU=</varname></term>
648 <term><varname>LimitFSIZE=</varname></term>
649 <term><varname>LimitDATA=</varname></term>
650 <term><varname>LimitSTACK=</varname></term>
651 <term><varname>LimitCORE=</varname></term>
652 <term><varname>LimitRSS=</varname></term>
653 <term><varname>LimitNOFILE=</varname></term>
654 <term><varname>LimitAS=</varname></term>
655 <term><varname>LimitNPROC=</varname></term>
656 <term><varname>LimitMEMLOCK=</varname></term>
657 <term><varname>LimitLOCKS=</varname></term>
658 <term><varname>LimitSIGPENDING=</varname></term>
659 <term><varname>LimitMSGQUEUE=</varname></term>
660 <term><varname>LimitNICE=</varname></term>
661 <term><varname>LimitRTPRIO=</varname></term>
662 <term><varname>LimitRTTIME=</varname></term>
663 <listitem><para>These settings control
664 various resource limits for executed
666 <citerefentry><refentrytitle>setrlimit</refentrytitle><manvolnum>2</manvolnum></citerefentry>
667 for details. Use the string
668 <varname>infinity</varname> to
669 configure no limit on a specific
670 resource.</para></listitem>
674 <term><varname>PAMName=</varname></term>
675 <listitem><para>Sets the PAM service
676 name to set up a session as. If set
677 the executed process will be
678 registered as a PAM session under the
679 specified service name. This is only
680 useful in conjunction with the
681 <varname>User=</varname> setting. If
682 not set no PAM session will be opened
683 for the executed processes. See
684 <citerefentry><refentrytitle>pam</refentrytitle><manvolnum>8</manvolnum></citerefentry>
685 for details.</para></listitem>
689 <term><varname>TCPWrapName=</varname></term>
690 <listitem><para>If this is a
691 socket-activated service this sets the
692 tcpwrap service name to check the
693 permission for the current connection
694 with. This is only useful in
695 conjunction with socket-activated
696 services, and stream sockets (TCP) in
697 particular. It has no effect on other
698 socket types (e.g. datagram/UDP) and
699 on processes unrelated to socket-based
700 activation. If the tcpwrap
701 verification fails daemon start-up
702 will fail and the connection is
704 <citerefentry><refentrytitle>tcpd</refentrytitle><manvolnum>8</manvolnum></citerefentry>
705 for details. Note that this option may
706 be used to do access control checks
707 only. Shell commands and commands
709 <citerefentry><refentrytitle>hosts_options</refentrytitle><manvolnum>5</manvolnum></citerefentry>
710 are not supported.</para></listitem>
714 <term><varname>CapabilityBoundingSet=</varname></term>
716 <listitem><para>Controls which
717 capabilities to include in the
718 capability bounding set for the
719 executed process. See
720 <citerefentry><refentrytitle>capabilities</refentrytitle><manvolnum>7</manvolnum></citerefentry>
721 for details. Takes a whitespace-separated
722 list of capability names as read by
723 <citerefentry><refentrytitle>cap_from_name</refentrytitle><manvolnum>3</manvolnum></citerefentry>,
724 e.g. <constant>CAP_SYS_ADMIN</constant>,
725 <constant>CAP_DAC_OVERRIDE</constant>,
726 <constant>CAP_SYS_PTRACE</constant>.
727 Capabilities listed will be included
728 in the bounding set, all others are
729 removed. If the list of capabilities
730 is prefixed with <literal>~</literal>
731 all but the listed capabilities will
732 be included, the effect of the
733 assignment inverted. Note that this
734 option also affects the respective
735 capabilities in the effective,
736 permitted and inheritable capability
738 <varname>Capabilities=</varname>
739 does. If this option is not used the
740 capability bounding set is not
741 modified on process execution, hence
742 no limits on the capabilities of the
743 process are enforced. This option may
744 appear more than once in which case
745 the bounding sets are merged. If the
746 empty string is assigned to this
747 option the bounding set is reset to
748 the empty capability set, and all
749 prior settings have no effect. If set
750 to <literal>~</literal> (without any
751 further argument) the bounding set is
752 reset to the full set of available
753 capabilities, also undoing any
754 previous settings.</para></listitem>
758 <term><varname>SecureBits=</varname></term>
759 <listitem><para>Controls the secure
760 bits set for the executed process. See
761 <citerefentry><refentrytitle>capabilities</refentrytitle><manvolnum>7</manvolnum></citerefentry>
762 for details. Takes a list of strings:
763 <option>keep-caps</option>,
764 <option>keep-caps-locked</option>,
765 <option>no-setuid-fixup</option>,
766 <option>no-setuid-fixup-locked</option>,
767 <option>noroot</option> and/or
768 <option>noroot-locked</option>. This
769 option may appear more than once in
770 which case the secure bits are
771 ORed. If the empty string is assigned
772 to this option the bits are reset to
777 <term><varname>Capabilities=</varname></term>
778 <listitem><para>Controls the
779 <citerefentry><refentrytitle>capabilities</refentrytitle><manvolnum>7</manvolnum></citerefentry>
780 set for the executed process. Take a
781 capability string describing the
782 effective, permitted and inherited
783 capability sets as documented in
784 <citerefentry><refentrytitle>cap_from_text</refentrytitle><manvolnum>3</manvolnum></citerefentry>.
785 Note that these capability sets are
786 usually influenced by the capabilities
787 attached to the executed file. Due to
789 <varname>CapabilityBoundingSet=</varname>
790 is probably the much more useful
791 setting.</para></listitem>
795 <term><varname>ControlGroup=</varname></term>
797 <listitem><para>Controls the control
798 groups the executed processes shall be
799 made members of. Takes a
800 space-separated list of cgroup
801 identifiers. A cgroup identifier is
803 <filename noindex='true'>cpu:/foo/bar</filename>,
804 where "cpu" indicates the kernel
805 control group controller used, and
806 <filename noindex='true'>/foo/bar</filename> is the
807 control group path. The controller
808 name and ":" may be omitted in which
809 case the named systemd control group
810 hierarchy is implied. Alternatively,
811 the path and ":" may be omitted, in
812 which case the default control group
813 path for this unit is implied.</para>
815 <para>This option may be used to place
816 executed processes in arbitrary groups
817 in arbitrary hierarchies -- which may
818 then be externally configured with
819 additional execution limits. By
820 default systemd will place all
821 executed processes in separate
822 per-unit control groups (named after
823 the unit) in the systemd named
824 hierarchy. This option is primarily
825 intended to place executed processes
826 in specific paths in specific kernel
827 controller hierarchies. It is not
828 recommended to manipulate the service
829 control group path in the private
830 systemd named hierarchy
831 (i.e. <literal>name=systemd</literal>),
832 and doing this might result in
833 undefined behaviour. For details about
834 control groups see <ulink
835 url="http://www.kernel.org/doc/Documentation/cgroups/cgroups.txt">cgroups.txt</ulink>.</para>
837 <para>This option may appear more than
838 once, in which case the list of
839 control group assignments is
840 merged. If the same hierarchy gets two
841 different paths assigned only the
842 later setting will take effect. If the
843 empty string is assigned to this
844 option the list of control group
845 assignments is reset, all previous
846 assignments will have no
849 <para>Note that the list of control
850 group assignments of a unit is
851 extended implicitly based on the
853 <varname>DefaultControllers=</varname>
855 <citerefentry><refentrytitle>systemd-system.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
857 <varname>ControlGroup=</varname>
858 setting for a specific controller
859 takes precedence.</para></listitem>
863 <term><varname>ControlGroupModify=</varname></term>
864 <listitem><para>Takes a boolean
865 argument. If true, the control groups
866 created for this unit will be owned by
867 the user specified with
868 <varname>User=</varname> (and the
869 appropriate group), and he/she can create
870 subgroups as well as add processes to
871 the group.</para></listitem>
875 <term><varname>ControlGroupPersistent=</varname></term>
876 <listitem><para>Takes a boolean
877 argument. If true, the control groups
878 created for this unit will be marked
879 to be persistent, i.e. systemd will
880 not remove them when stopping the
881 unit. The default is false, meaning
882 that the control groups will be
883 removed when the unit is stopped. For
884 details about the semantics of this
886 url="http://www.freedesktop.org/wiki/Software/systemd/PaxControlGroups">PaxControlGroups</ulink>.</para></listitem>
890 <term><varname>ControlGroupAttribute=</varname></term>
892 <listitem><para>Set a specific control
893 group attribute for executed
894 processes, and (if needed) add the
895 executed processes to a cgroup in the
896 hierarchy of the controller the
897 attribute belongs to. Takes two
898 space-separated arguments: the
899 attribute name (syntax is
900 <literal>cpu.shares</literal> where
901 <literal>cpu</literal> refers to a
902 specific controller and
903 <literal>shares</literal> to the
904 attribute name), and the attribute
906 <literal>ControlGroupAttribute=cpu.shares
907 512</literal>. If this option is used
908 for an attribute that belongs to a
909 kernel controller hierarchy the unit
910 is not already configured to be added
911 to (for example via the
912 <literal>ControlGroup=</literal>
913 option) then the unit will be added to
914 the controller and the default unit
915 cgroup path is implied. Thus, using
916 <varname>ControlGroupAttribute=</varname>
917 is in most cases sufficient to make
918 use of control group enforcements,
920 <varname>ControlGroup=</varname> are
921 only necessary in case the implied
922 default control group path for a
923 service is not desirable. For details
924 about control group attributes see
926 url="http://www.kernel.org/doc/Documentation/cgroups/cgroups.txt">cgroups.txt</ulink>. This
927 option may appear more than once, in
928 order to set multiple control group
929 attributes. If this option is used
930 multiple times for the same cgroup
931 attribute only the later setting takes
932 effect. If the empty string is
933 assigned to this option the list of
934 attributes is reset, all previous
935 cgroup attribute settings have no
936 effect, including those done with
937 <varname>CPUShares=</varname>,
938 <varname>MemoryLimit=</varname>,
939 <varname>MemorySoftLimit</varname>,
940 <varname>DeviceAllow=</varname>,
941 <varname>DeviceDeny=</varname>,
942 <varname>BlockIOWeight=</varname>,
943 <varname>BlockIOReadBandwidth=</varname>,
944 <varname>BlockIOWriteBandwidth=</varname>.
949 <term><varname>CPUShares=</varname></term>
951 <listitem><para>Assign the specified
952 overall CPU time shares to the
953 processes executed. Takes an integer
954 value. This controls the
955 <literal>cpu.shares</literal> control
956 group attribute, which defaults to
957 1024. For details about this control
958 group attribute see <ulink
959 url="http://www.kernel.org/doc/Documentation/scheduler/sched-design-CFS.txt">sched-design-CFS.txt</ulink>.</para></listitem>
963 <term><varname>MemoryLimit=</varname></term>
964 <term><varname>MemorySoftLimit=</varname></term>
966 <listitem><para>Limit the overall memory usage
967 of the executed processes to a certain
968 size. Takes a memory size in bytes. If
969 the value is suffixed with K, M, G or
970 T the specified memory size is parsed
971 as Kilobytes, Megabytes, Gigabytes,
972 or Terabytes (to the base
973 1024), respectively. This controls the
974 <literal>memory.limit_in_bytes</literal>
976 <literal>memory.soft_limit_in_bytes</literal>
977 control group attributes. For details
978 about these control group attributes
980 url="http://www.kernel.org/doc/Documentation/cgroups/memory.txt">memory.txt</ulink>.</para></listitem>
984 <term><varname>DeviceAllow=</varname></term>
985 <term><varname>DeviceDeny=</varname></term>
987 <listitem><para>Control access to
988 specific device nodes by the executed processes. Takes two
989 space-separated strings: a device node
991 <filename>/dev/null</filename>)
992 followed by a combination of r, w, m
993 to control reading, writing, or
994 creating of the specific device node
995 by the unit, respectively. This controls the
996 <literal>devices.allow</literal>
998 <literal>devices.deny</literal>
999 control group attributes. For details
1000 about these control group attributes
1002 url="http://www.kernel.org/doc/Documentation/cgroups/devices.txt">devices.txt</ulink>.</para></listitem>
1006 <term><varname>BlockIOWeight=</varname></term>
1008 <listitem><para>Set the default or
1009 per-device overall block IO weight
1010 value for the executed
1011 processes. Takes either a single
1012 weight value (between 10 and 1000) to
1013 set the default block IO weight, or a
1014 space-separated pair of a file path
1015 and a weight value to specify the
1016 device specific weight value (Example:
1017 "/dev/sda 500"). The file path may be
1018 specified as path to a block device
1019 node or as any other file in which
1020 case the backing block device of the
1021 file system of the file is
1022 determined. This controls the
1023 <literal>blkio.weight</literal> and
1024 <literal>blkio.weight_device</literal>
1025 control group attributes, which
1026 default to 1000. Use this option
1027 multiple times to set weights for
1028 multiple devices. For details about
1029 these control group attributes see
1031 url="http://www.kernel.org/doc/Documentation/cgroups/blkio-controller.txt">blkio-controller.txt</ulink>.</para></listitem>
1035 <term><varname>BlockIOReadBandwidth=</varname></term>
1036 <term><varname>BlockIOWriteBandwidth=</varname></term>
1038 <listitem><para>Set the per-device
1039 overall block IO bandwidth limit for
1040 the executed processes. Takes a
1041 space-separated pair of a file path and a
1042 bandwidth value (in bytes per second)
1043 to specify the device specific
1044 bandwidth. The file path may be
1045 specified as path to a block device
1046 node or as any other file in which
1047 case the backing block device of the
1048 file system of the file is determined.
1049 If the bandwidth is suffixed with K, M,
1050 G, or T the specified bandwidth is
1051 parsed as Kilobytes, Megabytes,
1052 Gigabytes, or Terabytes, respectively (Example:
1053 "/dev/disk/by-path/pci-0000:00:1f.2-scsi-0:0:0:0
1054 5M"). This controls the
1055 <literal>blkio.read_bps_device</literal>
1057 <literal>blkio.write_bps_device</literal>
1058 control group attributes. Use this
1059 option multiple times to set bandwidth
1060 limits for multiple devices. For
1061 details about these control group
1062 attributes see <ulink
1063 url="http://www.kernel.org/doc/Documentation/cgroups/blkio-controller.txt">blkio-controller.txt</ulink>.</para></listitem>
1067 <term><varname>ReadWriteDirectories=</varname></term>
1068 <term><varname>ReadOnlyDirectories=</varname></term>
1069 <term><varname>InaccessibleDirectories=</varname></term>
1071 <listitem><para>Sets up a new
1072 file system namespace for executed
1073 processes. These options may be used
1074 to limit access a process might have
1075 to the main file system
1076 hierarchy. Each setting takes a
1077 space-separated list of absolute
1078 directory paths. Directories listed in
1079 <varname>ReadWriteDirectories=</varname>
1080 are accessible from within the
1081 namespace with the same access rights
1082 as from outside. Directories listed in
1083 <varname>ReadOnlyDirectories=</varname>
1084 are accessible for reading only,
1085 writing will be refused even if the
1086 usual file access controls would
1087 permit this. Directories listed in
1088 <varname>InaccessibleDirectories=</varname>
1089 will be made inaccessible for
1090 processes inside the namespace. Note
1091 that restricting access with these
1092 options does not extend to submounts
1093 of a directory. You must list
1094 submounts separately in these settings
1095 to ensure the same limited
1096 access. These options may be specified
1097 more than once in which case all
1098 directories listed will have limited
1099 access from within the namespace. If
1100 the empty string is assigned to this
1101 option the specific list is reset, and
1102 all prior assignments have no
1103 effect.</para></listitem>
1107 <term><varname>PrivateTmp=</varname></term>
1109 <listitem><para>Takes a boolean
1110 argument. If true sets up a new file
1111 system namespace for the executed
1112 processes and mounts private
1113 <filename>/tmp</filename> and
1114 <filename>/var/tmp</filename> directories
1115 inside it, that are not shared by
1116 processes outside of the
1117 namespace. This is useful to secure
1118 access to temporary files of the
1119 process, but makes sharing between
1121 <filename>/tmp</filename> or
1122 <filename>/var/tmp</filename>
1123 impossible. All temporary data created
1124 by service will be removed after service
1125 is stopped. Defaults to
1126 false.</para></listitem>
1130 <term><varname>PrivateNetwork=</varname></term>
1132 <listitem><para>Takes a boolean
1133 argument. If true sets up a new
1134 network namespace for the executed
1135 processes and configures only the
1136 loopback network device
1137 <literal>lo</literal> inside it. No
1138 other network devices will be
1139 available to the executed process.
1140 This is useful to securely turn off
1141 network access by the executed
1142 process. Defaults to
1143 false.</para></listitem>
1147 <term><varname>MountFlags=</varname></term>
1149 <listitem><para>Takes a mount
1151 <option>shared</option>,
1152 <option>slave</option> or
1153 <option>private</option>, which
1154 control whether the file system
1155 namespace set up for this unit's
1156 processes will receive or propagate
1158 <citerefentry><refentrytitle>mount</refentrytitle><manvolnum>2</manvolnum></citerefentry>
1159 for details. Default to
1160 <option>shared</option>.</para></listitem>
1164 <term><varname>UtmpIdentifier=</varname></term>
1166 <listitem><para>Takes a four
1167 character identifier string for an
1168 utmp/wtmp entry for this service. This
1169 should only be set for services such
1170 as <command>getty</command>
1171 implementations where utmp/wtmp
1172 entries must be created and cleared
1173 before and after execution. If the
1174 configured string is longer than four
1175 characters it is truncated and the
1176 terminal four characters are
1177 used. This setting interprets %I style
1178 string replacements. This setting is
1179 unset by default, i.e. no utmp/wtmp
1180 entries are created or cleaned up for
1181 this service.</para></listitem>
1185 <term><varname>IgnoreSIGPIPE=</varname></term>
1187 <listitem><para>Takes a boolean
1188 argument. If true, causes <constant>SIGPIPE</constant> to be
1189 ignored in the executed
1190 process. Defaults to true because
1191 <constant>SIGPIPE</constant> generally is useful only in
1192 shell pipelines.</para></listitem>
1196 <term><varname>NoNewPrivileges=</varname></term>
1198 <listitem><para>Takes a boolean
1199 argument. If true, ensures that the
1200 service process and all its children
1201 can never gain new privileges. This
1202 option is more powerful than the respective
1203 secure bits flags (see above), as it
1204 also prohibits UID changes of any
1205 kind. This is the simplest, most
1206 effective way to ensure that a process
1207 and its children can never elevate
1208 privileges again.</para></listitem>
1212 <term><varname>SystemCallFilter=</varname></term>
1214 <listitem><para>Takes a space-separated
1216 names. If this setting is used, all
1217 system calls executed by the unit
1218 process except for the listed ones
1219 will result in immediate process
1220 termination with the
1221 <constant>SIGSYS</constant> signal
1222 (whitelisting). If the first character
1223 of the list is <literal>~</literal>
1224 the effect is inverted: only the
1225 listed system calls will result in
1226 immediate process termination
1227 (blacklisting). If this option is used
1228 <varname>NoNewPrivileges=yes</varname>
1229 is implied. This feature makes use of
1230 the Secure Computing Mode 2 interfaces
1231 of the kernel ('seccomp filtering')
1232 and is useful for enforcing a minimal
1233 sandboxing environment. Note that the
1234 <function>execve</function>,
1235 <function>rt_sigreturn</function>,
1236 <function>sigreturn</function>,
1237 <function>exit_group</function>,
1238 <function>exit</function> system calls
1239 are implicitly whitelisted and don't
1240 need to be listed explicitly. This
1241 option may be specified more than once
1242 in which case the filter masks are
1243 merged. If the empty string is
1244 assigned the filter is reset, all
1245 prior assignments will have no
1246 effect.</para></listitem>
1253 <title>See Also</title>
1255 <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
1256 <citerefentry><refentrytitle>systemctl</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
1257 <citerefentry><refentrytitle>journalctl</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
1258 <citerefentry><refentrytitle>systemd.unit</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
1259 <citerefentry><refentrytitle>systemd.service</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
1260 <citerefentry><refentrytitle>systemd.socket</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
1261 <citerefentry><refentrytitle>systemd.swap</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
1262 <citerefentry><refentrytitle>systemd.mount</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
1263 <citerefentry><refentrytitle>systemd.kill</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
1264 <citerefentry><refentrytitle>systemd.directives</refentrytitle><manvolnum>7</manvolnum></citerefentry>